Secret Scanning
Secret scanning is a method that inspects source code, configuration, and commit history for exposed credentials such as API keys, tokens, passwords, and private keys, alerting developers so leaked secrets can be revoked before attackers exploit them.
Secrets accidentally committed to a repository, like cloud access keys, database passwords, or signing keys, are a frequent and high-impact leak, because anyone with repo access (or a scraped public repo) can use them directly. Secret scanning detects these before or after they enter version control.
Detection combines several signals: regular-expression patterns for known credential formats (for example, a provider's key prefix), high-entropy string analysis to catch generic random tokens, and contextual heuristics to reduce noise from test data or placeholders. Effective scanners also examine git history, since a secret removed in the latest commit may still be recoverable from earlier ones.
For developers, secret scanning in pre-commit hooks and CI stops credentials from ever landing in shared history and surfaces existing exposures for rotation. The central challenge is precision: too many false positives cause alert fatigue, so quality engines tune entropy thresholds and context to keep findings actionable.